--- title: "Records of Processing Activities (RoPA) | Pitch" description: "What Article 30 GDPR requires you to record, who must keep a register, and how to keep it useful." url: https://pitch.law/academy/gdpr-records-of-processing-activities-ropa-what-you-need-to-know --- [pitch](https://pitch.law/) [Academy](https://pitch.law/academy) [Privacy & Data Protection](https://pitch.law/academy/topics/privacy) # Records of Processing Activities (RoPA) What Article 30 GDPR requires you to record, who must keep a register, and how to keep it useful. - - By [Bart Lieben](https://pitch.law/team/bart-lieben), Attorney-at-Law - 25 February 2026 - Updated 30-10-2026 ## The legal framework [Article 30 GDPR](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504#art_30) requires controllers and processors to keep a written record of their processing activities, including in electronic form. The record is internal. It is not published, but it must be made available to the supervisory authority on request (Article 30(4)), which is the national data protection authority. A controller's record contains, for each processing activity (Article 30(1)): - the name and contact details of the controller, any joint controller, the controller's representative and the Data Protection Officer; - the purposes of the processing; - the categories of data subjects and of personal data; - the categories of recipients, including those in third countries; - transfers to third countries or international organisations and, for certain transfers, the documented safeguards; - where possible, the envisaged time limits for erasure of the different categories of data; - where possible, a general description of the technical and organisational security measures. A processor keeps its own record under Article 30(2): the processors and controllers on whose behalf it acts, the categories of processing carried out for each controller, transfers, and a general description of security measures. ### Who must keep one Article 30(5) exempts enterprises or organisations with fewer than 250 employees, but the exemption does not apply if the processing is likely to result in a risk to the rights and freedoms of individuals, if the processing is not occasional, or if it includes special categories of data or data about criminal convictions. Employee payroll, customer administration and a standing mailing list are not occasional. In practice nearly every organisation that processes personal data on a regular basis must keep a record, whatever its size. ### What the record is for The record is one of the main ways to show accountability under [Article 5(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504#art_5). It is also the basis of other duties: the information you give under Articles [13](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504#art_13) and [14](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504#art_14), the response to access requests, the choice of retention periods, the selection of processors, and the identification of processing that needs a DPIA. ## In practice A software company in Ghent with 40 employees sells a subscription product to business customers. It processes personal data in at least two roles. As controller it processes employee data, applicant data, contact data of customer representatives and website visitor data. As processor it hosts its customers' end-user data. It therefore keeps two records: a controller record with perhaps ten to fifteen activities (payroll, recruitment, CRM, marketing email, website analytics, supplier management), and a processor record listing each customer for whom it processes data. For website analytics, the entry states the purpose (understanding use of the site), the categories (device and usage data of visitors), the recipient (the analytics provider), the transfer position (does the provider store data outside the EEA, and on what basis), the retention period (for instance fourteen months of raw data) and the security measures. The entry also points to the processing agreement with the provider, which is why the register and your [data processing agreements](https://pitch.law/solutions/data-processing-agreements) should be maintained together. Typical weaknesses are a register written once and never updated, entries that describe a department rather than a purpose, no retention period ("as long as necessary"), and processors that are missing. The authority will read an incomplete record as a sign that the underlying processing is not under control. ### Keeping it current The practical answer is ownership: a named person per processing activity who confirms the entry at least once a year and whenever a new tool or purpose is introduced. [Our register function](https://pitch.law/technologies/privacy-register) keeps entries in a shared record that your team edits and the DPO approves, and the [DPIA function](https://pitch.law/technologies/digital-data-protection-impact-assessment) starts from the register entry when an activity is high-risk. ## Frequently asked questions ### Is the record of processing the same as a privacy notice? No. The privacy notice informs individuals under Articles 13 and 14. The record is an internal document for accountability and for the authority. The two must be consistent. ### Does a small business with ten employees need a register? Usually yes. The 250-employee exemption is lost as soon as processing is not occasional or involves risk or special categories, which covers payroll and customer records. ### Must we record every system? The record is organised by processing activity, not by system. One activity may use several systems, and one system may serve several activities. ### Can the authority fine us for not having a record? Yes. A failure to keep a record falls under [Article 83(4)(a)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504#art_83), which allows fines of up to EUR 10 million or 2% of worldwide annual turnover. In practice, the absence of a record usually comes up as part of a wider investigation. ## How this connects A well-kept register is the base of [DPO as a Service](https://pitch.law/solutions/dpo-as-a-service) and the starting point when you draft or review [processing agreements](https://pitch.law/solutions/data-processing-agreements). Retention periods are covered in [how long you may keep personal data](https://pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data), and transfers in [international data transfers](https://pitch.law/academy/international-data-transfers-post-schrems-ii). ## In short - What Article 30 GDPR requires you to record - Who must keep a register, whatever their size - How to keep entries current ## Related solutions - [Solutions](https://pitch.law/solutions/dpo-as-a-service) ### [Data Protection Officer as a Service](https://pitch.law/solutions/dpo-as-a-service) [An external Data Protection Officer who advises, monitors and documents your GDPR compliance, with a register, calendar and portal behind the advice.](https://pitch.law/solutions/dpo-as-a-service) - [Solutions](https://pitch.law/solutions/data-processing-agreements) ### [Data Processing Agreements](https://pitch.law/solutions/data-processing-agreements) [Article 28 GDPR agreements drafted, reviewed and negotiated for controllers and processors, including sub-processors and international transfers.](https://pitch.law/solutions/data-processing-agreements) ## Technology we use - [Technology](https://pitch.law/technologies/privacy-register) ### [Records of Processing and Compliance Registers](https://pitch.law/technologies/privacy-register) [One register engine for the GDPR record of processing activities and for the AI Act, NIS2 and DORA registers, with article references, evidence and attorney or DPO approval.](https://pitch.law/technologies/privacy-register) - [Technology](https://pitch.law/technologies/digital-data-protection-impact-assessment) ### [Data Protection Impact Assessment](https://pitch.law/technologies/digital-data-protection-impact-assessment) [Guided data protection impact assessments, kept as working records that you and your attorney complete together in the client portal.](https://pitch.law/technologies/digital-data-protection-impact-assessment) - [Technology](https://pitch.law/technologies/contract-studio) ### [Document Studio](https://pitch.law/technologies/contract-studio) [Our Document Studio drafts and analyses legal documents in a secure, on-premise environment, and keeps the documents behind your matters up to date as new data comes in and procedural steps fall due.](https://pitch.law/technologies/contract-studio) - [Technology](https://pitch.law/technologies/breach-response-workflow) ### [Data Breach Handling](https://pitch.law/technologies/breach-response-workflow) [A GDPR Article 33 and 34 workflow with a 72-hour countdown, a reference per breach and a structured notification to the supervisory authority, approved by a lawyer.](https://pitch.law/technologies/breach-response-workflow) ## More in Privacy & Data Protection - ### [AI under Swiss Law and the GDPR: Key Differences](https://pitch.law/academy/ai-under-swiss-fadp-and-gdpr) [What the revised Swiss FADP and the GDPR mean for companies that build or use AI services: scope, legal bases, impact assessments, transfers, sanctions and the EU AI Act.](https://pitch.law/academy/ai-under-swiss-fadp-and-gdpr) - ### [Cookies and Consent](https://pitch.law/academy/cookie-compliance-and-consent-management) [When a cookie banner is required, what valid consent looks like and how the ePrivacy rules and the GDPR work together.](https://pitch.law/academy/cookie-compliance-and-consent-management) - ### [GDPR Breach Notification: the 72-Hour Rule](https://pitch.law/academy/data-breach-response-the-72-hour-countdown) [Article 33 GDPR: notify the authority within 72 hours of becoming aware of a personal data breach. When to notify, how hours count, when to tell people.](https://pitch.law/academy/data-breach-response-the-72-hour-countdown) - ### [GDPR Data Retention: How Long to Keep Personal Data](https://pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) [The GDPR sets no fixed retention period: Article 5(1)(e) allows no longer than necessary. How to set retention periods, handle backups and delete data.](https://pitch.law/academy/data-retention-policies-how-long-should-you-keep-personal-data) - ### [How to Answer a DSAR Within the GDPR Deadline](https://pitch.law/academy/data-subject-access-requests-dsars-practical-guide) [Answer a data subject access request within one month, extendable by two (Articles 12 and 15 GDPR): what to send, what you may refuse, how to keep time.](https://pitch.law/academy/data-subject-access-requests-dsars-practical-guide) - ### [International Data Transfers](https://pitch.law/academy/international-data-transfers-post-schrems-ii) [How Chapter V GDPR works after Schrems II: adequacy decisions, the EU-US Data Privacy Framework, standard contractual clauses and the assessment that goes with them.](https://pitch.law/academy/international-data-transfers-post-schrems-ii) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://pitch.law/schedule)